Address Poisoning Check MCP

An MCP server that checks crypto recipients for address poisoning lookalikes and bad checksums. It offers a free offline CLI check and a paid on-chain verification service via x402 on Base to detect dust or fake-token transfers planted by attackers.

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

Community listingStreamable HTTPNo sign-inEndpoint checked 2026-11-01Published by devx-agent

MCP endpoint (Streamable HTTP)

https://address-poisoning-check.nextill-pos.workers.dev/mcp

Vendor documentation

What you can do with it

Check if a recipient address is a lookalike of a trusted address
Verify EIP-55 checksum validity for crypto addresses
Scan sender history for zero-value or dust poisoning transfers
Gate agent payment flows with danger exit codes

Source and maintenance

Community listingRegistry 1.1.0

mcp-registry: io.github.devx-agent/address-poisoning-check@1.1.0 Source repository Project website

Maintenance checked: Nov 1, 2026, 6:38 AM UTC

Protocol and capabilities

Server: devx-address-poisoning-check 1.0.0
MCP protocol: 2025-06-18
Tools: 2 advertised
Resources: Not advertised
Resource templates: Not advertised
Prompts: Not advertised

Server-advertised capabilities

{
  "tools": {
    "listChanged": false
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

Address-poisoning check before sending crypto. Read-only; never asks for keys.

Tools

2 advertised

check_recipient_lookalike

Advertised by the server during the last successful anonymous check.

Advertised read-only

Free, offline, read-only: before sending crypto, check whether the recipient address is a lookalike (same first/last hex characters, different middle) of any address you trust, and whether its EIP-55 checksum is valid. Address poisoning stole $76M+ in 12 months by planting such lookalikes in wallet histories.

check_recipient_lookalike input schema

{
  "type": "object",
  "required": [
    "to"
  ],
  "properties": {
    "to": {
      "type": "string",
      "pattern": "^0x[0-9a-fA-F]{40}$",
      "description": "recipient you are about to pay"
    },
    "known": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "maxItems": 50,
      "description": "addresses you trust (address book, previous real payees)"
    }
  }
}

check_recipient_lookalike annotations

{
  "readOnlyHint": true,
  "openWorldHint": false
}

onchain_check_info

Advertised by the server during the last successful anonymous check.

Advertised read-only

How to buy the on-chain check (scans the sender's real transfer history on Ethereum/Base/Avalanche for poisoning transfers and lookalikes) via x402 for 0.005 USDC. Does not pay.

onchain_check_info input schema

{
  "type": "object",
  "properties": {}
}

onchain_check_info annotations

{
  "readOnlyHint": true
}

Prompts

Not advertised

No prompt definitions available.

Resources

Not advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks: 1 of 1 (100%)
Average latency: 441 ms
95th percentile latency: 441 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

Nov 1, 2026, 6:47 AM UTC · probe · passed · 441 ms · metadata changed · 2 tool(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.

Claude Code configuration

claude mcp add --transport http address-poisoning-check-mcp-workers https://address-poisoning-check.nextill-pos.workers.dev/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).

Codex configuration

codex mcp add address-poisoning-check-mcp-workers --url https://address-poisoning-check.nextill-pos.workers.dev/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable address-poisoning-check-mcp-workers in your MCP settings.

Cursor configuration

{
  "mcpServers": {
    "address-poisoning-check-mcp-workers": {
      "url": "https://address-poisoning-check.nextill-pos.workers.dev/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).

Cline configuration

{
  "mcpServers": {
    "address-poisoning-check-mcp-workers": {
      "type": "streamableHttp",
      "url": "https://address-poisoning-check.nextill-pos.workers.dev/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start address-poisoning-check-mcp-workers and inspect its tools.

VS Code configuration

{
  "servers": {
    "address-poisoning-check-mcp-workers": {
      "type": "http",
      "url": "https://address-poisoning-check.nextill-pos.workers.dev/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.

Gemini CLI configuration

gemini mcp add --transport http address-poisoning-check-mcp-workers https://address-poisoning-check.nextill-pos.workers.dev/mcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.

Claude Desktop configuration

{
  "mcpServers": {
    "address-poisoning-check-mcp-workers": {
      "url": "https://address-poisoning-check.nextill-pos.workers.dev/mcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.

Windsurf configuration

{
  "mcpServers": {
    "address-poisoning-check-mcp-workers": {
      "serverUrl": "https://address-poisoning-check.nextill-pos.workers.dev/mcp"
    }
  }
}

Let your agent find its tools

Find servers like Address Poisoning Check MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows

See all 3,926